Add TCM access control page #3866

p7nov · 2023-11-21T10:40:47Z

Resolves #3634

Deployment: https://docs.d.tarantool.io/en/doc/gh-3634-tcm-rbac/reference/tooling/tcm/tcm_access_control/

Add new section TCM > Access Control:

Permissions: administrative and cluster, concepts
Roles: concepts, management instructions
Users: concepts, management instructions
Passwords/secrets: definitions and concepts, management, expiry, blocking, password policy
Sessions
Permissions reference

TODO (in scope of #3637 ):

Move permissions reference to future section TCM > Reference
Move password policy items description to future section TCM > Reference.

filonenko-mikhail · 2023-11-21T11:13:44Z

doc/reference/tooling/tcm/tcm_access_control.rst

+    *   -   ``cluster.lowlevel.state.read``
+        -   Read low-level information about cluster configuration (for debug purposes)
+
+    *   -   ``cluster.lowlevel.state.write``
+        -   Write low-level information about cluster configuration (for debug purposes)


move it the bottom please to make it

filonenko-mikhail · 2023-11-21T11:13:55Z

doc/reference/tooling/tcm/tcm_access_control.rst

+    *   -   ``admin.lowlevel.state.read``
+        -   Read low-level information from |tcm| storage (for debug purposes)
+
+    *   -   ``admin.lowlevel.state.write``
+        -   Write low-level information to |tcm| storage (for debug purposes)


move it bottom please

filonenko-mikhail · 2023-11-21T11:14:24Z

doc/reference/tooling/tcm/tcm_access_control.rst

+        -   Toggle development mode
+
+    *   -   ``user.password.change``
+        -   Change own password


let's remove. seems that we dont use it in tcm, sorry

doc/reference/tooling/tcm/tcm_access_control.rst

andreyaksenov · 2023-11-21T13:33:00Z

doc/reference/tooling/tcm/tcm_access_control.rst

+    set of permissions for each cluster.
+
+    Technically, cluster permissions define pages shown in the **Cluster** section
+    of the left menu and controls available on these pages. For example, users


Don't quite understand to which word controls refers: permissions, section, menu?

doc/reference/tooling/tcm/tcm_access_control.rst

andreyaksenov · 2023-11-21T14:42:35Z

doc/reference/tooling/tcm/tcm_access_control.rst

+
+1.  Click **Add**.
+2.  Fill in the user information: username, full name, and description.
+3.  Generate or enter a password.


Not sure but to me enter a password sounds like it should be entered when logging in. I'd think about replacing it with specify.

andreyaksenov · 2023-11-21T14:46:16Z

doc/reference/tooling/tcm/tcm_access_control.rst

+and the private key is a password.
+
+Users receive their first passwords during the account creation. It can be entered
+manually or generated automatically.


I'd remove the second sentence here as it duplicates the info from Managing users (and added the link for account creation to Managing users).

andreyaksenov · 2023-11-21T14:50:48Z

doc/reference/tooling/tcm/tcm_access_control.rst

+Changing users' passwords
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Administrators can manage a user's passwords on this user's **Secrets** page.


a user's passwords

sounds like a user can have multiple passwords

This subject is confusing me a bit. The case of one TCM user having multiple secrets (username/password pairs) is technically possible. I didn't describe it on purpose: I don't see a valid real-life usage scenario for this.

AFAIU, this functionality is intended for use when TCM receives more than one way to authenticate users. For example, one user will have three secrets: a password, a certificate, and a fingerprint (whatever, just imagining :)). But right now it doesn't look useful on practice.

@filonenko-mikhail, what do you think? should we describe the case of multiple passwords explicitly (therefore encouraging readers to do this)?

andreyaksenov · 2023-11-21T14:58:36Z

doc/reference/tooling/tcm/tcm_access_control.rst

+-   **Block after N login attempts**.
+-   **User lockout time in seconds**.


Are these settings related? Don't quite understand the second one

Added the descriptions

andreyaksenov · 2023-11-21T15:01:02Z

doc/reference/tooling/tcm/tcm_access_control.rst

+        -   Manage LDAP configurations
+
+    *   -   ``admin.passwordpolicy.read``
+        -   View password policy


Looks like the first column should be a bit wider:

filonenko-mikhail · 2023-11-21T17:55:52Z

doc/reference/tooling/tcm/tcm_access_control.rst

+    :widths: 30 70
+    :header-rows: 1
+
+    *   -   Permission


my bad,

user.password.change is actual for access to change own password, please restore it

Co-authored-by: Andrey Aksenov <[email protected]>

filonenko-mikhail · 2023-11-22T05:52:24Z

No we should not Lets describe that password is one Ср, 22 нояб. 2023 г. в 06:41, Pavel Semyonov ***@***.***>:

…

***@***.**** commented on this pull request. ------------------------------ In doc/reference/tooling/tcm/tcm_access_control.rst <#3866 (comment)>: > +Users receive their first passwords during the account creation. It can be entered +manually or generated automatically. + +All passwords are governed by the :ref:`password policy <tcm_access_control_password_policy>`. +It can be flexibly configured to follow security requirements of your organization. + +Changing your password +~~~~~~~~~~~~~~~~~~~~~~ + +To change your own password, click your name in the top-right corner and go to +**Settings** > **Change password**. + +Changing users' passwords +~~~~~~~~~~~~~~~~~~~~~~~~~ + +Administrators can manage a user's passwords on this user's **Secrets** page. This subject is confusing me a bit. The case of one TCM user having multiple username/password pairs is technically possible. I didn't describe it on purpose: I don't see a valid real-life usage scenario for this. AFAIU, this functionality is intended for use when TCM receives more than one way to authenticate users. For example, one user will have three secrets: a password, a certificate, and a fingerprint (whatever, just imagining :)). But right now it doesn't look useful on practice. @filonenko-mikhail <https://github.com/filonenko-mikhail>, what do you think? should we describe the case of multiple passwords explicitly (therefore encouraging readers to do this)? — Reply to this email directly, view it on GitHub <#3866 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAC2O53SJPLNM4XNQ7XXL4DYFVX6BAVCNFSM6AAAAAA7UKYXAGVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMYTONBTGQ4TQMZYHA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

doc/reference/tooling/tcm/tcm_access_control.rst

Co-authored-by: Andrey Aksenov <[email protected]>

Resolves #3634 Co-authored-by: Andrey Aksenov <[email protected]>

p7nov mentioned this pull request Nov 21, 2023

Add TCM access control draft #3856

Closed

Add TCM access control draft

5a904ed

p7nov force-pushed the gh-3634-tcm-rbac branch from b241d6a to 5a904ed Compare November 21, 2023 11:01

filonenko-mikhail reviewed Nov 21, 2023

View reviewed changes

filonenko-mikhail approved these changes Nov 21, 2023

View reviewed changes

Rearrange permissions lists

504f013

p7nov requested a review from andreyaksenov November 21, 2023 11:57

andreyaksenov suggested changes Nov 21, 2023

View reviewed changes

filonenko-mikhail reviewed Nov 21, 2023

View reviewed changes

Apply suggestions from code review

41583ba

Co-authored-by: Andrey Aksenov <[email protected]>

Review fixes

97b8988

andreyaksenov approved these changes Nov 22, 2023

View reviewed changes

doc/reference/tooling/tcm/tcm_access_control.rst Outdated Show resolved Hide resolved

p7nov and others added 2 commits November 22, 2023 14:42

Apply suggestions from code review

a16c58f

Co-authored-by: Andrey Aksenov <[email protected]>

Review fixes

b9ed864

p7nov merged commit 40e9ad4 into 3.0 Nov 22, 2023

p7nov deleted the gh-3634-tcm-rbac branch November 22, 2023 08:03

andreyaksenov added a commit that referenced this pull request Dec 6, 2023

Add TCM access control page (#3866)

55ea644

Resolves #3634 Co-authored-by: Andrey Aksenov <[email protected]>

		- Block after N login attempts.
		- User lockout time in seconds.

Add TCM access control page #3866

Add TCM access control page #3866

Uh oh!

Conversation

p7nov commented Nov 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

p7nov Nov 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andreyaksenov Nov 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

filonenko-mikhail Nov 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

filonenko-mikhail commented Nov 22, 2023 via email

Uh oh!

Uh oh!

Uh oh!

p7nov commented Nov 21, 2023 •

edited

Loading

p7nov Nov 22, 2023 •

edited

Loading

andreyaksenov Nov 21, 2023 •

edited

Loading

filonenko-mikhail Nov 21, 2023 •

edited

Loading